CVE-2026-8452: Citrix NetScaler Added to CISA KEV Alongside Five Legacy Flaws — Detection and Remediation Guide

On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. The headline entry is CVE-2026-8452, a memory buffer vulnerability in Citrix NetScaler ADC and NetScaler Gateway — the same internet-facing appliance class that has been the initial access vector for some of the most damaging intrusions of the past several years. Alongside it sit five older flaws across Red Hat Linux, Microsoft SQL Server, Ajax.NET Professional, and the Linux kernel, all now confirmed as present-day attack paths, not historical trivia.

If you run NetScaler in your DMZ, treat this as an active-incident scenario, not a routine patch cycle. Perimeter appliances sit in front of your most sensitive authentication and application traffic, have historically limited EDR visibility, and are favored by both financially motivated actors and state-sponsored intrusion sets. The inclusion of legacy CVEs in this batch is equally instructive: threat actors are systematically sweeping for unpatched assets years after disclosure, and any organization that deprioritized these fixes because of their age is now exposed to live exploitation.

Technical Analysis

CVE-2026-8452 — Citrix NetScaler ADC and Gateway Buffer Overflow

• Affected products: Citrix NetScaler ADC and NetScaler Gateway (appliances and VPX/MPX form factors); consult the Citrix security bulletin for the enumerated supported builds.
• Vulnerability class: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer. This class on NetScaler has historically enabled unauthenticated remote code execution and sensitive memory disclosure against the packet processing engine and HTTP service.
• Exploitation vector: Remote, targeting the management or gateway virtual server interfaces exposed to the network — frequently the public internet. Exploitation of memory corruption in the NetScaler data path typically does not require valid credentials.
• Exploitation status: Confirmed active exploitation; listed in the CISA KEV Catalog on 2026-08-26. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate by the CISA-assigned due date (typically three weeks from listing — mid-September 2026). Private-sector organizations should hold themselves to the same clock.

Post-exploitation behavior against NetScaler is well documented from prior campaigns: attackers drop web shells under the gateway and VPN content directories, execute commands via the appliance shell, and harvest credentials and session tokens for downstream access. On a compromised appliance you should expect to see the NetScaler packet engine or HTTP processes spawning shells and interpreters — behavior that is never legitimate in production.

The Legacy Five — Old Bugs, Live Exploitation

These are not new discoveries. They are being re-exploited today against estates that never finished patching:

• CVE-2015-3246 — Red Hat libuser race condition: A race in the libuser library allows a local unprivileged user to corrupt /etc/passwd and gain root. Post-exploitation artifact: unexpected modification of /etc/passwd by non-administrative processes.
• CVE-2015-5287 — Red Hat ABRT privilege escalation: The Automatic Bug Reporting Tool could be abused by local users to execute code with elevated privileges via crafted crash dump handling.
• CVE-2019-1068 — Microsoft SQL Server remote code execution: Allows an attacker to execute code in the context of the SQL Server service account. The hallmark detection remains sqlservr.exe spawning cmd.exe, powershell.exe, or other child processes — the classic path from database compromise to host compromise.
• CVE-2021-23758 — Ajax.NET Professional deserialization of untrusted data: The .NET library deserializes attacker-controlled input, enabling remote code execution in any ASP.NET application embedding the vulnerable component. In IIS environments, watch w3wp.exe spawning command shells.
• CVE-2022-0995 — Linux kernel watch_queue out-of-bounds write: An out-of-bounds write in the kernel's watch queue implementation enables local privilege escalation to root.

The pattern across the batch is consistent: local privilege escalation chains on Linux, and RCE-to-host-control chains on Windows application servers. Attackers use these as the second stage after gaining an initial foothold — which makes behavioral detection on process lineage more durable than signature-based detection on the exploits themselves.

Detection & Response

Sigma Rules

The following rules target the highest-fidelity observable behaviors from this KEV batch: NetScaler post-exploitation command execution, SQL Server service account breakout, IIS worker process abuse (Ajax.NET deserialization), and suspicious modification of /etc/passwd (libuser race condition).

---
title: NetScaler Post-Exploitation Shell Spawning
id: 4e7c2a91-6b3d-4f18-9c05-2a8d7e1b4f60
status: experimental
description: Detects NetScaler packet engine or HTTP service processes spawning shells or interpreters, consistent with post-exploitation activity against NetScaler ADC/Gateway memory corruption vulnerabilities such as CVE-2026-8452.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nsppe'
      - '/nshttpd'
      - '/nsnetsvc'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare scripted appliance maintenance executed under service context
level: critical
---
title: SQL Server Service Process Spawning Command Shell
id: 8b1f4d26-3c7a-4e59-b2d8-5f9a1c6e3d72
status: experimental
description: Detects sqlservr.exe spawning command shells or script interpreters, a hallmark of SQL Server exploitation including CVE-2019-1068 and xp_cmdshell abuse chains.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate maintenance jobs invoking xp_cmdshell (should be disabled by policy)
level: high
---
title: IIS Worker Process Spawning Shells - Deserialization Exploitation
id: 2c9a6e84-1f5b-4d37-a8c2-7e4b9d1f5a38
status: experimental
description: Detects the IIS worker process spawning command shells or interpreters, consistent with exploitation of .NET deserialization flaws such as CVE-2021-23758 in Ajax.NET Professional.
references:
  - https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/27
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy applications that shell out for batch processing (inventory and suppress by app pool identity)
level: high

For the libuser race condition (CVE-2015-3246), file integrity monitoring on /etc/passwd, /etc/shadow, and /etc/group — alerting on writes from any process other than authorized account-management tooling — provides the most reliable detection with near-zero false positives. Deploy via auditd with a watch rule (-w /etc/passwd -p wa -k identity_files) if FIM is not already in place.

KQL — Microsoft Sentinel / Defender

This query hunts SQL Server and IIS service-account breakout on Windows endpoints via Defender, and surfaces NetScaler-originated shell execution where appliance syslog is ingested into Sentinel.

// Hunt 1: Windows service breakout (SQL Server CVE-2019-1068, Ajax.NET CVE-2021-23758)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("sqlservr.exe", "w3wp.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "whoami.exe", "net.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

// Hunt 2: NetScaler shell spawning via syslog ingestion (tune Computer/parser to your ingestion path)
Syslog
| where TimeGenerated > ago(14d)
| where Computer has "netscaler" or HostIP startswith "10."  // scope to your NetScaler syslog sources
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "curl ", "wget ", "chmod +x")
| where SyslogMessage has_any ("nsppe", "nshttpd", "nsroot", "nobody")
| project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep Windows application servers for service-account breakout process lineage during threat hunts or after confirming exposure to the vulnerable components.

-- Hunt for shells and LOLBins spawned by SQL Server or IIS worker processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(cmd|powershell|pwsh|mshta|rundll32|certutil|whoami)'
   AND (
        Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)sqlservr|w3wp')
       )

For Linux estate sweeps, hunt for the libuser race condition artifact — /etc/passwd modified outside of change windows:

-- Check /etc/passwd and /etc/shadow modification times against authorized change windows
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=['/etc/passwd', '/etc/shadow', '/etc/group'])
ORDER BY Mtime DESC

Remediation Script — NetScaler Verification and Linux Privesc Surface Audit

Run the following on NetScaler appliances (via shell) to snapshot build information and hunt for the most common post-exploitation artifacts, then on Red Hat-family Linux hosts to confirm the legacy CVEs are remediated.

#!/bin/bash
# === NetScaler ADC/Gateway: CVE-2026-8452 triage ===
# Run on the appliance shell. Review output before and after patching.

echo "=== NetScaler Build ==="
nsver -version 2>/dev/null || cat /flash/nsconfig/.version 2>/dev/null || show version

echo "=== Web shell artifacts in gateway/vpn content dirs ==="
find /netscaler /var/vpn /var/netscaler/gui -type f -mmin -10080 \( -name "*.php" -o -name "*.jsp" -o -name "*.pl" \) -ls 2>/dev/null

echo "=== Recently modified files in web content roots ==="
find /netscaler /var/vpn -type f -mtime -14 -ls 2>/dev/null

echo "=== Unexpected processes spawned by packet engine/httpd ==="
ps aux | grep -E "(sh|bash|python|perl|php|curl|wget|nc )" | grep -vE "(grep|nsconf|systemd)"

echo "=== Cron and persistence review ==="
crontab -l 2>/dev/null; ls -la /var/cron/tabs/ 2>/dev/null; cat /flash/nsconfig/rc.netscaler 2>/dev/null | tail -20

# === Red Hat-family Linux: legacy KEV CVE verification ===
# Run on RHEL/CentOS hosts.

echo "=== libuser version (CVE-2015-3246 requires libuser >= 0.56.13-8 / 0.60-5) ==="
rpm -q libuser

echo "=== abrt version (CVE-2015-5287) ==="
rpm -q abrt abrt-addon-ccpp 2>/dev/null

echo "=== Kernel version (CVE-2022-0995 watch_queue OOB write) ==="
uname -r

echo "=== FIM baseline: hash identity files, alert on drift ==="
sha256sum /etc/passwd /etc/shadow /etc/group | tee /root/identity_files_baseline.sha256

echo "=== SUID binary audit (privesc staging surface) ==="
find / -xdev -perm -4000 -type f -ls 2>/dev/null | sort > /root/suid_audit_$(date +%F).txt

Remediation

Priority 1 — CVE-2026-8452 (Citrix NetScaler ADC/Gateway):

1. Patch immediately. Upgrade to the fixed build listed in Citrix's security bulletin for CVE-2026-8452 at https://support.citrix.com — do not wait for a maintenance window given confirmed exploitation. CISA's BOD 22-01 due date applies to federal agencies (mid-September 2026); treat it as your internal SLA regardless of sector.
2. Assume breach until proven otherwise. Because exploitation predates your patch, patching alone does not evict an attacker. After upgrading, run the triage script above, review AAA/authentication logs for anomalous logins, and force credential rotation for any accounts that traversed the gateway (session token and credential theft are standard NetScaler post-exploitation objectives).
3. Reduce exposure. Ensure the management interface (NSIP) is never internet-reachable — restrict it to a dedicated management network with jump-host access only. Gateway vServers must be internet-facing by design; compensate with WAF rules, TLS inspection where feasible, and syslog forwarding to your SIEM (appliances with local-only logs are forensically blind).
4. Rebuild if compromise is confirmed. NetScaler appliances support clean re-imaging from known-good firmware plus restored configuration. If you find web shells or unauthorized persistence, rebuild rather than clean — firmware-level persistence is difficult to fully exclude.

Priority 2 — Legacy five (sweep your estate this week):

• CVE-2019-1068 (SQL Server): Apply the cumulative update from Microsoft (KB4505222 and later CUs for SQL Server 2016/2017). Disable xp_cmdshell where not required, and run SQL services under least-privilege gMSA accounts — the service account context is what the attacker inherits.
• CVE-2021-23758 (Ajax.NET Professional): Inventory ASP.NET applications for the vulnerable library (check bin directories for AjaxPro DLLs), upgrade to a patched release per the vendor advisory, and consider retiring the component — .NET deserialization gadgets remain a favored RCE primitive.
• CVE-2015-3246 / CVE-2015-5287 (Red Hat): Confirm libuser and abrt packages meet fixed versions via yum updateinfo list cves / rpm -q --changelog. Any host still vulnerable to 2015-era CVEs is a flashing red light for your patch governance — escalate the root cause, not just the fix.
• CVE-2022-0995 (Linux kernel): Confirm kernels are at or above the fixed release for your distribution (the watch_queue OOB write was patched in mainline 5.17; verify your distro backport). Where patching lags, restrict unprivileged user namespaces and audit SUID binaries to shrink the local privesc surface.

Governance takeaway: This KEV batch — one 2026 flaw and five aged 4 to 11 years — is empirical proof that vulnerability age is irrelevant to exploitation risk. Align your SLAs to the KEV catalog, not to CVSS scores or disclosure dates. If your VM program cannot enumerate exposure to all six of these within 24 hours, that gap is your next project.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub